Page History
...
| Info |
|---|
A configuration file for stubby Stubby containing a subset of these servers which can all be validated can be found here. A JSON file with the details of the same subset of servers can be downloaded here. Note that the Yeti servers use a different root key for DNSSEC! See the Yeti project for more details |
| Hosted by | IP addresses | TLS Ports | Hostname for TLS authentication | Base 64 encoded form of SPKI pin(s) for TLS authentication (RFC7858) | Logging | Software | Notes |
|---|---|---|---|---|---|---|---|
| The following are currently in the default Stubby config file mainly because they have been around longest and are the most stable. | |||||||
| getdnsapi.net | |||||||
UPDATED on 13th April 2017!
185.49.141.37 | 853 | getdnsapi.net | foxZRnIh9gZpWnl+zEiKa0EJ2rdCGroMWm02gaxSc9S= | Traffic volume only |
| Unbound | |||||
| Surfnet | 145.100.185.15 | 853 | dnsovertls.sinodun.com | 62lKu9HsDVbyiPenApnc4sfmSYTHOVfFgL3pyB+cBL4= | Traffic volume only |
| HAProxy + BIND |
| Surfnet | 145.100.185.16 | 853 | dnsovertls1.sinodun.com | cE2ecALeE5B+urJhDrJlVFmf38cJLAvqekONvjvpqUA= | Traffic volume only |
| Nginx + BIND |
(no UDP or TCP on port 53)
| UncensoredDNS | 89.233.43.71 | 853 | unicast.censurfridns.dk | wikE3jYAA6jQmXYTr/rbHeEPmC78dQwZbQp6WdrseEs= | Traffic volume only | See https://blog.uncensoreddns.org/ | |
| Other servers with no/minimal logging | |||||||
| Surfnet | 145.100.185.17 | 853 | dnsovertls2.sinodun.com | NAXBESvpjZMnPWQcrxa2KFIkHV/pDEIjRkA3hLWogSg= | |||
| Traffic volume only | Knot Resolver |
(no UDP or TCP on port 53)
| dns1.darkmoon.is | 51.15.70.167 | 853 | dns1.darkmoon.is | 8sx8niFUiJvMM3C1qLE9cH79TuQQztzMVDtbKjpD/IQ= | Traffic volume only | Unbound | |
| dkg | 199.58.81.218 | 853 |
443 53053 | dns.cmrg.net | 3IOHSS48KOc/zlkKGtI46a9TY9PPKDVGhE3W2ZS4JZo= | None |
| Knot Resolver |
Note that on port 443 this server can serve both HTTP 1.1 traffic (to securely access the nameserver credentials) on TLS connections and DNS-over-TLS on separate TLS connections due to some nifty, experimental demultiplexing of traffic, described here |
89.233.43.71
2a01:3a0:53:53::0
unicast.censurfridns.dk
. |
| securedns.eu | 146.185.167.43 | 853 | securedns.eu | sduWN2+EK2c5T/ATd6jqNuc/cdiHAxULzjtPu6CqJR0= | None |
| Unbound |
| dns-tls.bitwiseshift.net | 81.187.221.24 | 853 | dns-tls.bitwiseshift.net | YmcYWZU5dd2EoblZHNf1jTUPVS+uK3280YYCdz4l4wo= |
| None | Unbound |
Only listening on TLS on port 853
(no UDP or TCP on port 53)
2001:4b98:dc2:43:216:3eff:fea9:41a
dns-resolver.yeti.eu.org
UPDATED on 26th Jun 2017
YxtXAorQNSo+333ko1ctuXcnpMcplPaOI/GCM+YeMQk=
| ns1.dnsprivacy.at | 94.130.110.185 2a01:4f8:c0c:3c03::2 | 853 | ns1.dnsprivacy.at | vqVQ9TcoR9RDY3TpO0MTXw1YQLjF44zdN3/4PkLwtEY= | None | Unbound | |
| ns2.dnsprivacy.at | 94.130.110.178 2a01:4f8:c0c:3bfc::2 | 853 | ns2.dnsprivacy.at | s5Em89o0kigwfBF1gcXWd8zlATSWVXsJ6ecZfmBDTKg= | None | Unbound | |
| Servers with some or no logging, self-signed certs or no support for Strict mode | |||||||
| Go6Lab | 2001:67c:27e4::35 | 853 | privacydns.go6lab.si | g5lqtwHia/plKqWU/Fe2Woh4+7MO3d0JYqYJpj/iYAw= | Unknown | Unbound | |
| Lorraine Data Network | 80.67.188.188 | 853 | |||||
WaG0kHUS5N/ny0labz85HZg+v+f0b/UQ73IZjFep0nM= |
| Yes, logging at stunnel | stunnel 4 + BIND | See https://ldn-fai.net/serveur-dns-recursif-ouvert/ |
184.105.193.78
2620:ff:c000:0:1::64:25
tls-dns-u.odvr.dns-oarc.net
pOXrpUt9kgPgbWxBFFcBTbRH2heo2wHwXp1fd4AEVXI=
NOTE: As of June 2017 this server does not support Strict Mode because it does not offer the correct cipher suites to match RFC7525 recommendations.
. |
Only listening on TLS on port 853
(no UDP or TCP on port 53)
NIC Chile | 200.1.123.46 | 853 | dnsotls.lab.nic.cl | sG6kj+XJToXwt1M6+9BeCz1SOj/1/mdZn56OZvCyZZc= | Yes, for research purposes | Unbound |
Self-signed certificate, please use SPKI pinning. |
Only listening on TLS on port 853
(no UDP or TCP on port 53)
2a01:4f8:c0c:3c03::2
Only listening on TLS on port 853
(no UDP or TCP on port 53)
2a01:4f8:c0c:3bfc::2
(no UDP or TCP on port 53)
| Yeti | 2001:4b98:dc2:43:216:3eff:fea9:41a | 853 | dns-resolver.yeti.eu.org | UPDATED on 26th Jun 2017 | Yes, see Yeti website | Unbound | See https://dns-resolver.yeti.eu.org/ |
| OARC | 184.105.193.78 | 853 | tls-dns-u.odvr.dns-oarc.net | pOXrpUt9kgPgbWxBFFcBTbRH2heo2wHwXp1fd4AEVXI= | Yes, see OARC website | Unbound | See OARC website NOTE: As of June 2017 this server does not support Strict Mode because it does not offer the correct cipher suites to match RFC7525 recommendations. |
(1) Since the nameserver is behind a proxy the client IP is not logged inside the nameserver
...
